The Agent Skills Directory

[COMMAND_EXECUTION]: The skill implements an execute_code tool that compiles and runs arbitrary C# 6 method bodies directly within the Unity Editor environment. The documentation explicitly warns that this is not a sandboxed environment, meaning executed code has the same privileges as the Unity process.
[COMMAND_EXECUTION]: The execute_menu_item tool allows the agent to trigger any menu item within the Unity Editor, which could be used to perform unauthorized operations or bypass UI-based safety expectations.
[REMOTE_CODE_EXECUTION]: The manage_packages tool enables the installation of Unity packages from arbitrary Git URLs and local file paths. This provides a mechanism for downloading and executing untrusted code within the development project.
[DATA_EXFILTRATION]: The manage_camera and manage_scene tools support taking screenshots with the include_image=True parameter. This returns base64-encoded image data directly to the AI, which could inadvertently expose sensitive source code, project assets, or developer information visible in the editor.
[EXTERNAL_DOWNLOADS]: The documentation references and provides examples of downloading packages from external sources (e.g., github.com/GlitchEnzo/NuGetForUnity.git), which introduces a dependency on third-party code integrity.
[COMMAND_EXECUTION]: The manage_editor tool includes a deploy_package action that copies source code into the project's installed package directory. This capability could be abused to modify existing tools or establish persistence within the project environment.

unity-mcp-skill